Is it secure if I make my api token public with lightning-charge-client-js?

[elementsproject]

Is it secure if I make my api token public with lightning-charge-client-js?

[shesek]

No, it is not secure to make the access token public. The client connecting to Lightning Charge is expected to be controlled by you, not by third parties. While the access token does not allow withdrawing funds (Charge does not support sending, only receiving), it does provide read access to the entire invoices and payments history, which are considered private information.

If you want to allow third-parties to create new invoices and get payment notifications for their own payments, you'll need to have a service sitting in between and exposing the bits of functionality you want to make public (in particular, users should be able to lookup an invoice by its id, but never get access to invoices that they don't know the id of).

You can see some example nodejs implementations in nanopos, lightning-jukebox and filebazaar.

[jiyu3]

Thanks. Just as expected. I just use lightning charge and hide my token.